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Amended claims follow: 

1. (currently amended) A computer program product comprising a computer 
program operable to control a computer to generate audit data indicative of a request to 
execute a computer program, said computer program comprising: 

(i) computer virus scanner logic, responsive to a computer virus scan request 
including data identifying a computer file to be scanned for computer viruses, for 
performing a computer virus scan and for generating a scan result; [and] 

(ii) audit data generator logic triggered by said computer virus scanner logic, 
and responsive to said data identifying said computer file to be scanned, for identifying a 
request to execute a computer program and, in response to identification of said request 
to execute said computer program, for generating audit data identifying said computer 
program: and 

(iii) concurrent usage logic for performing a concurrent usage check for 
identifying a request to execute a further computer program that would result in said 
further computer program concurrently executing upon more than a predetermined 
number of computers upon a computer network: 

wherein said predetermined number varies with time . 

2. (original) A computer program product as claimed in claim 1, wherein a file 
access request to an operating system triggers generation of said computer virus scan 
request. 
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3. (original) A computer program product as claimed in claim 1, wherein said 
audit data generator logic is responsive to data identifying one or more banned computer 
programs to identify a request to execute a banned computer program. 

4. (original) A computer program product as claimed in claim 3, wherein, if a 
request to execute a banned computer program is identified, then one or more banned 
program actions are triggered, said banned program actions including one or more of: 

(i) said banned computer program is deleted; 

(ii) said banned computer program is disabled; 

(iii) . said banned program is encrypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is issued. 

5. (original) A computer program product as claimed in claim 3, wherein said data 
identifying one or more banned computer programs is a permitted computer program list 
with any computer program not included within said permitted computer program list 
being a banned computer program. 

6. (cancelled) 

7. (currently amended) A computer program product as claimed in claim [6]_L 
wherein, if said concurrent usage check indicates that said request to execute said further 
computer program would result in more than said predetermined number of computers 
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upon said computer network concurrently executing said computer program, then said 
request to execute said further computer program is denied. 

8. (previously presented) A computer program product as claimed in claim 7, 
wherein a user message is displayed when execution of said further computer program is 
prevented. 

9. (cancelled) 

10. (currently amended) A computer program product as claimed in claim [9]i, 
wherein at certain times said predetermined number is zero. 

11. (original) A computer program product as claimed in claim 1, wherein said 
audit data generator logic calculates a checksum value from said computer file 3 said 
checksum value being used in identification of said computer file as a particular 
computer program. 

12. (original) A computer program product as claimed in claim 11, wherein said 
audit data generator logic stores said calculated checksum value and uses said stored 
calculated checksum values instead of recalculating said checksum value when said 
computer file subject to a subsequent access without any intervening change having been 
made to said computer file. 
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13. (original) A computer program product as claimed in claim 1, wherein said 
audit data generator logic is responsive to a non-user specified database of data indicative 
of particular computer programs. 

14. (original) A computer program product as claimed in claim 1, wherein said 
audit data generator logic is responsive to a user specified database of data indicative of 
particular computer programs. 

15. (original) A computer program product as claimed in claim 1, wherein said 
computer virus scan request results from an on-access scan. 

16. (original) A computer program product as claimed in claim 1 ? wherein said 
computer virus scan request results from an on-demand scan. 

17. (original) A computer program product as claimed in claim 1, wherein local 
audit data is stored upon a computer within a computer network until said computer is 
polled by a remote computer upon said computer network whereupon said local audit 
data is sent to said remote computer. 

18. (original) A computer program product as claimed in claim 17, wherein said 
remote computer generates a consolidated audit report for a plurality of computers upon 
said computer network. 
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19. (currently amended) A method of generating audit data indicative of a request 
to execute a computer program, said method comprising the steps of: 

(i) responsive to a computer virus scan request within a computer virus 
scanner, performing a computer virus scan and generating a scan result, said computer 
virus scan request including data identifying a computer file to be scanned for computer 
viruses; 

(ii) triggering operation of an audit data generator using said computer vims 
scanner, said audit data generator being responsive to said data identifying said computer 
file to be scanned to identify a request to execute a computer program; [and] 

(iii) in response to identification of said request to execute said computer 
program, generating audit data identifying said computer program ; and 

fly) performing a concurrent usage check for identifying a request to execute a 
further computer program that would result in said further computer program 
concurrently executing upon more than a predetermined number of computers upon a 
computer network: 

wherein said predetermined number varies with time , 

20. (original) A method as claimed in claim 19, wherein a file access request to an 
operating system triggers generation of said computer virus scan request, 

21 . (original) A method as claimed in claim 19, wherein said audit data generator 
is responsive to data identifying one or more banned computer programs to identify a 
request to execute a banned computer program. 
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22. (original) A method as claimed in claim 21, wherein, if a request to execute a 
banned computer program is identified, then one or more banned program actions are 
triggered, said banned program actions including one or more of: 

(i) said banned computer program is deleted; 

(ii) said banned computer program is disabled; 

(iii) said banned program is encrypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is issued. 

23. (original) A method as claimed in claim 21, wherein said data identifying one 
or more banned computer programs is a permitted computer program list with any 
computer program not included within said permitted computer program list being a 
banned computer program. 

24. (cancelled) 

25. (currently amended) A method as claimed in claim [24] 19» wherein, if said 
concurrent usage check indicates that said request to execute said further computer 
program would result in more than said predetermined number of computers upon said 
computer network concurrently executing said further computer program, then said 
request to execute said further computer program is denied. 
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26. (previously presented) A method as claimed in claim 25, wherein a user 
message is displayed when execution of said further computer program is prevented. 

27. (cancelled) 

28. (currently amended) A method as claimed in claim [27]19, wherein at certain 
times said predetermined number is zero. 

29. (original) A method as claimed in claim 19, wherein said audit data generator 
calculates a checksum value from said computer file, said checksum value being used in 
identification of said computer file as a particular computer program. 

30. (original) A method as claimed in claim 29, wherein said audit data generator 
stores said calculated checksum value and uses said stored calculated checksum values 
instead of recalculating said checksum value when said computer file subject to a 
subsequent access without any intervening change having been made to said computer 
file. 

3 1 . (original) A method as claimed in claim 1 9 T wherein said audit data generator 
is responsive to a non-user specified database of data indicative of particular computer 
programs. 
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32. (original) A method as claimed in claim 19, wherein said audit data generator 
is responsive to a user specified database of data indicative of particular computer 
programs. 

33. (original) A method as claimed in claim 19, wherein said computer virus scan 
request results from an on-access scan. 

34. (original) A method as. claimed in claim 19, wherein said computer vims scan 
request results from an on-demand scan. 

35. (original) A method as claimed in claim 19, wherein local audit data is stored 
upon a computer within a computer network until said computer is polled by a remote 
computer upon said computer network whereupon said local audit data is sent to said 
remote computer. 

36. (original) A method as claimed in claim 35, wherein said remote computer 
generates a consolidated audit report for a plurality of computers upon said computer 
network. 

37. (currently amended) Apparatus for generating audit data indicative of a 
request to execute a computer program, said apparatus comprising: 

(i) a computer virus scanner, responsive to a computer virus scan request, for 
performing a computer virus scan and for generating a scan result, said computer virus 
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scan request including data identifying a computer file to be scanned for computer 
viruses; [and] 

(ii) an audit data generator triggered by said computer virus scanner logic, and 
responsive to said data identifying said computer file to be scanned, for identifying a 
request to execute a computer program and, in response to identification of said request 
to execute said computer program, for generating audit data identifying said computer 
program : and 

concurrent usage monitor for performing a concurrent usage check for identifying 
a request to execute a further computer program that would result in said further 
computer program concurrent ly executing upon more than a predetermined number of 
computers upon a computer network: 

wherein said predetermined number varies with time . 

38. (original) Apparatus as claimed in claim 37, wherein a file access request to 
an operating system triggers generation of said computer virus scan request. 

39. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
is responsive to data identifying one ot more banned computer programs to identify a 
request to execute a banned computer program. 

40. (original) Apparatus as claimed in claim 39, wherein, if a request to execute a 
banned computer program is identified, then one or more banned program actions are 
triggered, said banned program actions including one or more of: 



PAffi 13B2 ' RCVD AT 10112/2005 5:12:51 PM [Eastern Daylight Time] * SVfcUSPTO-EFXRF-605 ' DfflS:2738300 * CSID:4089714660 * DURATION (mm-ss):0448 



OCT. 12. 2005 2:25PM ZILKA-KOTAB. PC NO. 0507 P. 14 

-11- 

(i) said banned computer program is deleted; 

(ii) said banned computer program is disabled; 

(iii) said banned program is encrypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is issued. 

41. (original) Apparatus as claimed in claim 39, wherein said data identifying one 
or more banned computer programs is a permitted computer program list with any 
computer program not included within said permitted computer program list being a 
banned computer program. 

42. (cancelled) 

43. (currently amended) Apparatus as claimed in claim [42] 37, wherein, if said 
concurrent usage check indicates that said request to execute said further computer 
program would result in more than said predetermined number of computers upon said 
computer network concurrently executing said further computer program, then said 
request to execute said further computer program is denied. 

44. (previously presented) Apparatus as claimed in claim 43, wherein a user 
message is displayed when execution of said further computer program is prevented 

45. (cancelled) 
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46. (currently amended) Apparatus as claimed in claim [45J37, wherein at certain 
times said predetermined number is zero. 

47. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
calculates a checksum value from said computer file, said checksum value being used in 
identification of said computer file as a particular computer program. 

48. (original) Apparatus as claimed in claim 47, wherein said audit data generator 
stores said calculated checksum value and uses said stored calculated checksum values 
instead of recalculating said checksum value when said computer file subject to a 
subsequent access without any intervening change having been made to said computer 
file. 

49. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
is responsive to a non-user specified database of data indicative of particular computer 
programs. 

50. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
is responsive to a user specified database of data indicative of particular computer 
programs. 

51. (original) Apparatus as claimed in claim 37, wherein said computer virus scan 
request results from an on-access scan. 
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52. (original) Apparatus as claimed in claim 37, wherein said computer virus scan 
request results from an on-demand scan. 

53. (original) Apparatus as claimed in claim 37 5 wherein local audit data is stored 
upon a computer within a computer network until said computer is polled by a remote 
computer upon said computer network whereupon said local audit data is sent to said 
remote computer. 

54. (original) Apparatus as claimed in claim 53, wherein said remote computer 
generates a consolidated audit report for a plurality of computers upon said computer 
network.. 

55. (currently amended) A computer program product comprising a computer 
program operable to control a computer to generate audit data indicative of a request to 
execute a computer program, said computer program comprising; 

(i) computer virus scanner logic, responsive to a computer virus scan request 
including data identifying a computer file to be scanned for computer viruses, for 
performing a computer virus scan and for generating a scan result; 

(ii) audit data generator logic triggered by said computer virus scanner logic, 
and responsive to said data identifying said computer file to be scanned, for identifying a 
request to execute a computer program and, in response to identification of said request 
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to execute said computer program, for generating audit data identifying said computer 
program; and 

(iii) concurrent usage logic for performing a concurrent usage check for 
identifying a request to execute a further computer program that would result in said 
further computer program concurrently executing upon more than a predetermined 
number of computers upon a computer network; 

wherein said predetermined number varies with time. 



56. (currently amended) A method of generating audit data indicative of a request 
to execute a computer program, said method comprising the steps of: 

(i) responsive to a computer virus scan request within a computer virus 
scanner, performing a computer virus scan and generating a scan result, said computer 
virus scan request including data identifying a computer file to be scanned for computer 
viruses; 

(ii) triggering operation of an audit data generator using said computer virus 
scanner, said audit data generator being responsive to said data identifying said computer 
file to be scanned to identify a request to execute a computer program; 

(iii) in response to identification of said request to execute said computer 
program, generating audit data identifying said computer program; and 

(iv) performing a concurrent usage check for identifying a request to execute a 
further computer program that would result in said further computer program 
concurrently executing upon more than a predetermined number of computers upon a 
computer network; 
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wherein said predetermined number varies with time. 
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57. (currently amended) Apparatus for generating audit data indicative of a 
request to execute a computer program, said apparatus comprising: 

(i) a computer virus scanner, responsive to a computer virus scan request, for 
performing a computer virus scan and for generating a scan result, said computer virus 
scan request including data identifying a computer file to be scanned for computer 
viruses; 

(ii) an audit data generator triggered by said computer virus scanner logic, and 
responsive to said data identifying said computer file to be scanned, for identifying a 
request to execute a computer program and, in response to identification of said request 
to execute said computer program, for generating audit data identifying said computer 
program; and 

(iii) a concurrent usage monitor for performing a concurrent usage check for 
identifying a request to execute a further computer program that would result in said 
further computer program concurrently executing upon more than a predetermined 
number of computers upon a computer networki 

wherein said p redetermined number varies with time . 
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